From nobody Fri May 22 21:46:24 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gMf463ZP4z6fnwQ for ; Fri, 22 May 2026 21:46:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gMf4612Chz3kJJ for ; Fri, 22 May 2026 21:46:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779486390; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WDSEDEzdxSN8arHVrcWPorBZMEnQUgUNded3VoaCUXs=; b=Bo+y4dhfXjNnxqnQQ+ONCseimKHiAlB9992AAgYG4oMxS9isqNObU3l8hV9+aMRqwD5nBm lsZOLTYm5Kh0R5L9VNlMiWQOQbIUUyanmVW+ik+nBT32qDnYLgsG33XY9XtcRbKj/Mbm/r 1K3CM0SplRBoPewhRTMxm+/ad3d//jOKYTq39JsTO+NSBN9s5TY7NZNfR4gMDciKGw/xOx +VxILNwK3DVkjdT2wiiCzgUdempiDbwfL0WVXZ7PyrayS9oRsALs+d8QP7E0IShQW7j0Qp P0R/c1+6mm3HQrzatvMYzTpyxmErR9UWpBTmKwZppCiuzqruf54+hmF6phOaiA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1779486390; a=rsa-sha256; cv=none; b=saYvJ8XROZ7dW8MmU69/HrSCLmkhASFwBx7RBDZSEKh7zzhOqmmFtfVHBSsgz2AUOqFR0+ qp0iPNi/y8w03rVDI8engokQB2sv/qom0Bm5gmpP7BnO/R7VFc40eJq0k71Mg3h+7PQZYM VF7+DfpMyn1S4wf8rY2Z8ZvFAdxSbf9XwTL3TjTNyss17Tx4hPGlVwCV7tsLWO+UZJL7H3 2QprF+5iNeQvH80NkX7piHIQuQuKFbRdxwP9b8uIkcjR6E8i+CYxj2En11/nV3Hdqxjygm jgXLFH97ljREpcvIfI2lWqU998a2I4rgX58vfA93yZN6ceHr1gQrdB/zNAiTOw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1779486390; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WDSEDEzdxSN8arHVrcWPorBZMEnQUgUNded3VoaCUXs=; b=tFvouYTHCodaoLQPcMr8Fvv3IwwKjkxiWqXDO6nVl7rE7u1b6wNua6m8AfAueXAtRAbefS ThARR0BoWX/ePPBd0IwcrxV3WiVHfWHT7dGTfTWEViHu1aNjImLl+qLWmti4F70/C+d1ws lNCkXLOBAaLdOYrltjz/tG26iGW7tc0lEIDJOTcuHrDPPLeyy6MJXYa6dvwPBSexPU+7zx /gVDmrQ3ElqcqP3HxQ2uMToIVnC48zUXRkh50N286vOTobxO3Kt15W4EFFo6uhyLa6o/04 uMhQfyQtili9jtg3tiJhoOut2AzWR3KyOPDPZTrsxCDh1HMNQfwkOfGF+EBkvg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gMf4606lLzg2H for ; Fri, 22 May 2026 21:46:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 20638 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 22 May 2026 21:46:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Pat Maddox From: Dave Cottlehuber Subject: git: c783d7181d6a - main - syslogd: fix memory leak in casper_ttymsg() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dch X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: c783d7181d6a71cb2453f06e40c08c892510c2f2 Auto-Submitted: auto-generated Date: Fri, 22 May 2026 21:46:24 +0000 Message-Id: <6a10ceb0.20638.75cedd6c@gitrepo.freebsd.org> The branch main has been updated by dch: URL: https://cgit.FreeBSD.org/src/commit/?id=c783d7181d6a71cb2453f06e40c08c892510c2f2 commit c783d7181d6a71cb2453f06e40c08c892510c2f2 Author: Pat Maddox AuthorDate: 2026-05-22 21:45:30 +0000 Commit: Dave Cottlehuber CommitDate: 2026-05-22 21:45:30 +0000 syslogd: fix memory leak in casper_ttymsg() nvlist_take_string_array(9) takes ownership of the array and its strings. casper_ttymsg() freed neither, leaking memory on every F_CONSOLE and F_TTY message. On long-running systems with high error-rate syslog traffic routed to /dev/console, syslogd.casper grew to hundreds of MB. Use nvlist_get_string_array(9) to borrow the array instead. Update casper_wallmsg() similarly. Approved by: src (des) Closes: https://github.com/freebsd/freebsd-src/pull/2222 Fixes: 61a29eca550b ("syslogd: Log messages using libcasper") MFC after: 3 days MFC to: stable/15 PR: 295488 Reported by: Pat Maddox Reviewed by: markj Tested by: dch --- usr.sbin/syslogd/syslogd_cap_log.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/usr.sbin/syslogd/syslogd_cap_log.c b/usr.sbin/syslogd/syslogd_cap_log.c index 0156cc6f6b6c..5e2034abd9eb 100644 --- a/usr.sbin/syslogd/syslogd_cap_log.c +++ b/usr.sbin/syslogd/syslogd_cap_log.c @@ -128,19 +128,19 @@ cap_ttymsg(cap_channel_t *chan, struct iovec *iov, int iovcnt, int casper_ttymsg(nvlist_t *nvlin, nvlist_t *nvlout) { - char **nvlstrs; + const char * const *nvlstrs; struct iovec *iov; size_t iovcnt; int tmout; const char *line; - nvlstrs = nvlist_take_string_array(nvlin, "iov_strs", &iovcnt); + nvlstrs = nvlist_get_string_array(nvlin, "iov_strs", &iovcnt); assert(iovcnt <= TTYMSG_IOV_MAX); iov = calloc(iovcnt, sizeof(*iov)); if (iov == NULL) err(EXIT_FAILURE, "calloc"); for (size_t i = 0; i < iovcnt; ++i) { - iov[i].iov_base = nvlstrs[i]; + iov[i].iov_base = __DECONST(char *, nvlstrs[i]); iov[i].iov_len = strlen(nvlstrs[i]); } line = nvlist_get_string(nvlin, "line"); @@ -187,25 +187,23 @@ int casper_wallmsg(nvlist_t *nvlin) { const struct filed *f; - char **nvlstrs; + const char * const *nvlstrs; struct iovec *iov; size_t sz; f = nvlist_get_binary(nvlin, "filed", &sz); assert(sz == sizeof(*f)); - nvlstrs = nvlist_take_string_array(nvlin, "iov_strs", &sz); + nvlstrs = nvlist_get_string_array(nvlin, "iov_strs", &sz); assert(sz <= TTYMSG_IOV_MAX); iov = calloc(sz, sizeof(*iov)); if (iov == NULL) err(EXIT_FAILURE, "calloc"); for (size_t i = 0; i < sz; ++i) { - iov[i].iov_base = nvlstrs[i]; + iov[i].iov_base = __DECONST(char *, nvlstrs[i]); iov[i].iov_len = strlen(nvlstrs[i]); } wallmsg(f, iov, sz); - for (size_t i = 0; i < sz; ++i) - free(iov[i].iov_base); free(iov); return (0); }